- A
IAM policies with a Deny effect for CloudTrail actions
Why wrong: IAM policies can restrict permissions, but they are scoped to a specific IAM user, group, or role. Account administrators can modify or create new IAM policies to bypass these restrictions, so they do not provide a centrally enforceable guardrail across all accounts.
- B
AWS Config rules with an auto-remediation action
Why wrong: AWS Config rules can evaluate whether CloudTrail is enabled and can trigger a remediation action (e.g., re-enabling CloudTrail) if a violation is detected. However, they cannot prevent the action from occurring in the first place; they only react after the fact. Also, Config rules are scoped per account, not centrally enforced across the organization.
- C
Service Control Policies (SCPs)
SCPs are the correct choice. They allow you to define a central permission guardrail at the organization level that applies to all accounts, including the root user. An SCP denying CloudTrail disablement will prevent any principal in the account from disabling the trail, and it automatically applies to new accounts added to the organization.
- D
AWS CloudTrail trails with multi-region and organization trail enabled
Why wrong: An organization trail can log events from all accounts to a single bucket, but it does not prevent users from disabling or deleting the trail. It is a logging mechanism, not an enforcement mechanism. SCPs are required to enforce the desired restriction.
CLF-C02 Security and Compliance Practice Question
This CLF-C02 practice question tests your understanding of security and compliance. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. A key principle to apply: sCPs set maximum available permissions for accounts in an AWS Organization.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses AWS Organizations to manage multiple AWS accounts. The security team needs to ensure that Amazon CloudTrail is enabled in all AWS Regions for every member account, and that no user (including account administrators) can disable it. The policy must apply automatically to any new accounts that are added to the organization. Which AWS feature should the security team use to enforce this requirement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Service Control Policies (SCPs)
Service Control Policies (SCPs) are the correct choice because they allow the security team to centrally control the maximum available permissions for all accounts within an AWS Organization. By creating an SCP that denies all CloudTrail disabling actions (e.g., `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail`) and attaching it to the root or specific organizational units, the policy applies automatically to all existing and new member accounts, and even account administrators cannot override it. This ensures CloudTrail remains enabled across all Regions in every account, meeting the enforcement requirement.
Key principle: SCPs set maximum available permissions for accounts in an AWS Organization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IAM policies with a Deny effect for CloudTrail actions
Why it's wrong here
IAM policies can restrict permissions, but they are scoped to a specific IAM user, group, or role. Account administrators can modify or create new IAM policies to bypass these restrictions, so they do not provide a centrally enforceable guardrail across all accounts.
- ✗
AWS Config rules with an auto-remediation action
Why it's wrong here
AWS Config rules can evaluate whether CloudTrail is enabled and can trigger a remediation action (e.g., re-enabling CloudTrail) if a violation is detected. However, they cannot prevent the action from occurring in the first place; they only react after the fact. Also, Config rules are scoped per account, not centrally enforced across the organization.
- ✓
Service Control Policies (SCPs)
Why this is correct
SCPs are the correct choice. They allow you to define a central permission guardrail at the organization level that applies to all accounts, including the root user. An SCP denying CloudTrail disablement will prevent any principal in the account from disabling the trail, and it automatically applies to new accounts added to the organization.
Related concept
SCPs set maximum available permissions for accounts in an AWS Organization.
- ✗
AWS CloudTrail trails with multi-region and organization trail enabled
Why it's wrong here
An organization trail can log events from all accounts to a single bucket, but it does not prevent users from disabling or deleting the trail. It is a logging mechanism, not an enforcement mechanism. SCPs are required to enforce the desired restriction.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse IAM policies (which are account-specific and can be bypassed by administrators) with SCPs (which are organization-wide and cannot be overridden by account administrators), leading them to choose IAM Deny policies instead of SCPs.
Detailed technical explanation
How to think about this question
SCPs work by filtering the permissions that are effective in each account; they do not grant permissions themselves but act as a boundary that limits what IAM policies can allow. When an SCP denies an action, it overrides any Allow in IAM policies, even for the root user of the account, because SCPs are evaluated before IAM policies in the AWS authorization process. In a real-world scenario, if a new account is created via AWS Organizations, the SCP attached to the root or parent OU automatically applies, ensuring consistent enforcement without manual intervention.
KKey Concepts to Remember
- SCPs set maximum available permissions for accounts in an AWS Organization.
- SCPs apply to all users and roles, including the root user, within affected accounts.
- SCPs are inherited by all accounts in an Organizational Unit (OU) or the organization.
- SCPs are evaluated before IAM policies and can deny actions that IAM policies might allow.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
SCPs set maximum available permissions for accounts in an AWS Organization.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Review sCPs set maximum available permissions for accounts in an AWS Organization., then practise related CLF-C02 questions on the same topic to reinforce the concept.
- →
Security and Compliance — study guide chapter
Learn the concepts, then practise the questions
- →
Security and Compliance practice questions
Targeted practice on this topic area only
- →
All CLF-C02 questions
1,024 questions across all exam domains
- →
AWS Certified Cloud Practitioner CLF-C02 study guide
Full concept coverage aligned to exam objectives
- →
CLF-C02 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related CLF-C02 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Cloud Concepts practice questions
Practise CLF-C02 questions linked to Cloud Concepts.
Security and Compliance practice questions
Practise CLF-C02 questions linked to Security and Compliance.
Cloud Technology and Services practice questions
Practise CLF-C02 questions linked to Cloud Technology and Services.
Billing, Pricing, and Support practice questions
Practise CLF-C02 questions linked to Billing, Pricing, and Support.
AWS shared responsibility model practice questions
Practise CLF-C02 questions linked to AWS shared responsibility model.
AWS IAM practice questions
Practise CLF-C02 questions linked to AWS IAM.
AWS pricing practice questions
Practise CLF-C02 questions linked to AWS pricing.
AWS support plans practice questions
Practise CLF-C02 questions linked to AWS support plans.
AWS S3 practice questions
Practise CLF-C02 questions linked to AWS S3.
AWS EC2 practice questions
Practise CLF-C02 questions linked to AWS EC2.
Practice this exam
Start a free CLF-C02 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this CLF-C02 question test?
Security and Compliance — This question tests Security and Compliance — SCPs set maximum available permissions for accounts in an AWS Organization..
What is the correct answer to this question?
The correct answer is: Service Control Policies (SCPs) — Service Control Policies (SCPs) are the correct choice because they allow the security team to centrally control the maximum available permissions for all accounts within an AWS Organization. By creating an SCP that denies all CloudTrail disabling actions (e.g., `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail`) and attaching it to the root or specific organizational units, the policy applies automatically to all existing and new member accounts, and even account administrators cannot override it. This ensures CloudTrail remains enabled across all Regions in every account, meeting the enforcement requirement.
What should I do if I get this CLF-C02 question wrong?
Review sCPs set maximum available permissions for accounts in an AWS Organization., then practise related CLF-C02 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
SCPs set maximum available permissions for accounts in an AWS Organization.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
More CLF-C02 practice questions
- A company publishes a message each time a new product is added to its catalogue. Three services need to receive this mes…
- A media company stores frequently accessed video thumbnails in Amazon S3. The thumbnails are read multiple times every d…
- A company needs a service to translate domain names (like www.example.com) into IP addresses, check the health of their…
- A startup runs an application on AWS and receives a monthly bill that charges exactly for the number of compute hours us…
- A financial institution runs its core banking application on-premises due to regulatory requirements. It has connected i…
- A company wants to run a MySQL database in AWS without managing database software installation, applying patches, settin…
Last reviewed: Jun 11, 2026
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.